Glossary · Email

MTA-STS (SMTP MTA Strict Transport Security)

MTA-STS is a standard that lets a domain require TLS and a valid certificate when other servers deliver mail to it, preventing downgrade attacks.

Updated October 6, 2026

MTA-STS (Mail Transfer Agent Strict Transport Security) lets a domain publish a policy saying that servers sending it mail must use TLS and must verify the receiving server's certificate and hostname. Without it, SMTP encryption is opportunistic and can be stripped by an attacker.

Why it matters

Server-to-server STARTTLS falls back to plain text when the upgrade fails, so an attacker on the path can force a downgrade or redirect mail. MTA-STS closes that gap. It has two parts: a DNS TXT record announcing a policy version, and a policy file served over HTTPS from a fixed address. It is conceptually similar to HSTS for the web. Pairing it with TLS-RPT gives visibility into failures.

Example

DNS record:

_mta-sts.example.com. IN TXT "v=STSv1; id=20261005T000000"

Policy at https://mta-sts.example.com/.well-known/mta-sts.txt:

version: STSv1
mode: testing
mx: mail.example.com
max_age: 604800

Start in testing mode, then move to enforce once reports look clean.

Common mistakes

  • Forgetting to change the id after editing the policy, so senders keep the cached version.
  • Listing an mx pattern that does not match your real MX hosts and blocking your own mail in enforce mode.
  • Letting the policy site's HTTPS certificate expire.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Guide · EmailMTA-STS and TLS-RPT Guide: Enforce TLS for Inbound EmailHow to set up MTA-STS and TLS-RPT: the DNS TXT records, the policy file on mta-sts.example.com, testing, enforce mode, and how to read TLS reports.6 min readError fix · Email errorsSMTP 454 TLS Not Available Due to Temporary ReasonFix SMTP 454 4.7.0 "TLS not available due to temporary reason": broken certificates, unreadable key files, expired chains and STARTTLS failures.4 min readGlossary · EmailCatch-All AddressA catch-all address is a mailbox setting that accepts mail sent to any address at a domain, including ones that do not exist, and delivers it to one inbox.Glossary · EmailEmail AliasAn email alias is an extra address that forwards to an existing mailbox, letting one inbox receive mail for several names without separate accounts.Glossary · EmailEmail Bounce (Hard and Soft)An email bounce is a failed delivery notice from a mail server, with a 4xx or 5xx SMTP code showing whether the failure is temporary or permanent.Guide · EmailBIMI Explained: Show Your Logo in the Inbox (Requirements and Setup)What BIMI is, what it requires (DMARC enforcement, SVG Tiny PS logo, VMC or CMC certificate), how the DNS record looks, and which mailbox providers display it.6 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.